Conventionally, a control device for controlling a power plant includes three input modules, three operation modules and three output modules. The control device outputs, as a control signal for controlling the power plant, an output signal obtained by taking the majority of three output signals outputted by three output modules. By this means, even if abnormality occurs in any one of three input modules, three operation modules and three output modules and any one of the output modules cannot therefore perform correct output, a correct control signal is continuously outputted by majority decision. Accordingly, even if the abnormality occurs in any one of three input modules, three operation modules and three output modules, the control device can continue correct control.
In the conventional control device, if the first abnormality is caused in any one of three input modules, three operation modules and three output modules and the second abnormality is then caused in a component of a different kind from a component in which the first abnormality is caused, it becomes impossible to perform a normal majority operation. Therefore, it is necessary to stop processing and enter a safe state. An example of the case where the second abnormality is caused in the component of the different kind from the component in which the first abnormality is caused is a case where the component in which the first abnormality is caused is an input module and the second abnormality is then caused in an operation module or an output module. Therefore, there is a problem that it is not possible to continue control when the abnormality is caused in two components of different kinds.